+1 for DMARC - you can set your policy to ask the recipient to reject (or mark as spam) anything that fails the DMARC check. But yes, it is tricky to get right, so go for no action initially and monitor the reports.